System and method for identifying an encryptor that encodes a file on a computer system

Abstract

The present application relates to systems and methods for identifying an encryptor that encodes files of a computer system. An exemplary method includes: identifying one or more files that have data input performed by a suspicious process; for each identified file, determining a characteristic of the identified file; using a trained machine learning model and the corresponding characteristic of the identified file, identifying a category of file modification; identifying a suspicious process as being associated with the encryptor based on the identified category of file modification of the file; and protecting the computer system from the encryptor.

Description

Technical Field

[0001] The present invention relates to the field of data security, and more particularly to a system and method for identifying an encryptor that encodes files of a computer system. Background Art

[0002] The rapid development of computer technology in recent years and the widespread distribution of computing devices (personal computers, laptops, tablets, smartphones, etc.) have strongly stimulated the use of these devices in various fields of activity and for a large number of tasks (from processing and storage of private photos to bank transfers and electronic document management). The growth in the number of computing devices and the software running on these devices is accompanied by a rapid growth in the amount of harmful software.

[0003] There are many different types of harmful software, most of which are designed to make a profit for their creators. One type of harmful software steals the user's personal and confidential data (such as login names and passwords, bank account details, electronic documents, etc.) from the user's device. Another type of harmful software forms a so-called botnet from the user's device to attack other computers, computer networks or web (network) resources (for example, through "denial of service" attacks or "brute force" attacks). A third type of harmful software provides paid content to users through persistent advertising, paid subscriptions, SMS messages to premium numbers, etc.

[0004] One type of harmful software includes harmful software programs that are used for the purpose of extortion (known as ransomware). When these ransomware programs appear on the user's device, they render the device inoperable (for example, by blocking input devices, destroying data, limiting access to interface elements, etc.). The victim is usually urged to pay to restore access to his / her files, but, even when this is done, the malicious party does not always restore control of the data or device to its rightful owner. The most dangerous ransomware programs include harmful software that encrypts files (encryptors). Their harmful actions include destroying data that is valuable to the user (such as databases, Microsoft Office documents, photos, video files, etc.). Data is corrupted by encrypting, renaming, or hiding the files containing this data. Because both the confidentiality and integrity of data are usually highly valued, protecting data is an important task.

[0005] One way to combat the above threats is to promptly detect harmful applications on user devices and then disable them, thereby protecting data from unapproved modifications, while also regularly creating backup copies of the data so that the data can be restored even in the event of unapproved modifications. However, new forms of encryptors are constantly being created. As new forms of encryptors emerge, new signatures must be written regularly to identify them. Various large amounts of computing resources are consumed on the task of updating signatures. However, in some cases, the encryptors decrypt themselves after being launched using unique decompressors - thereby increasing the complexity of signature-based detection required to ensure computing security from such attacks.

[0006] Another approach is based on behavior detection. Compared to signature detection, behavior detection offers a more flexible approach. This is mainly because behavior-based detection is based on monitoring the characteristic features of the encryptor distribution. This provides the opportunity to detect the presence or modification of a large number of files. However, these methods also have disadvantages.

[0007] First of all, the distinguishing feature of encryptors is that they deny access to many or even all files of a given type (images, financial documents, etc.) on the hard disk. When such behavior is detected, some data will be encrypted. To counter the operation of the encryptor, backup copies of the affected files may be used, but this requires further resource consumption and therefore slows down the operation of legitimate software.

[0008] Secondly, there are many programs whose behavior also exhibits characteristics associated with the following actions in the file system, which present encryptor characteristics. For example, archiver applications have many behavioral characteristics that present encryptor characteristics. For example, both types of software may quickly modify a large number of user files, and the files generated after the user files are executed have many similar characteristics. It is difficult to find any difference between encryptor and archiver applications using certain rules or analysis algorithms. This may result in the incorrect classification of archive-type programs as harmful. In other words, type II errors (false negatives) may increase. However, files installed by harmful software show certain differences from legitimate user files, and it has been proposed that encrypted files should be searched based on these differences to detect the activities of Trojan encryptors.

[0009] However, most existing methods for detecting encryptors do not take advantage of a key feature of harmful encryption software, which is the creation of sacrificial files on the computer where the information cannot be read by the user without being decrypted by the malicious party. This creates a technical problem of high levels of Type I errors (false positives) and Type II errors for identifying harmful software that encrypts files on a computer system.

[0010] Therefore, there is a need for a more optimized and more efficient way to detect encryptors using the latest machine learning methods. In other words, there is a need for a system and method for identifying encryptors that encode files on a computer system. Summary of the invention

[0011] Aspects of the present invention relate to data security and, more particularly, to systems and methods for identifying encryptors that encode files of a computer system.

[0012] In one exemplary aspect, a method for identifying an encryptor that encodes files of a computer system is provided, the method comprising: identifying one or more files whose data input was performed by a suspicious process; for each identified file, determining characteristics of the identified file; identifying a category of file modification using a trained machine learning model and the corresponding characteristics of the identified files; and identifying the suspicious process as associated with the encryptor based on the category of file modification of the identified files; and protecting the computer system from the encryptor.

[0013] In one aspect, the method further includes detecting harmful software by sequentially checking all processes of the computer system, wherein the sequential checking includes identifying the checked processes as suspicious processes.

[0014] In one aspect, the suspicious process is associated with an updateable list of predetermined processes.

[0015] In one aspect, the categories of file modifications include at least one category of file modifications made by an encryptor and at least one other category of file modifications made by legitimate software.

[0016] In one aspect, protection of a computer system includes at least one of: stopping a suspicious process and all flows and other processes associated with the suspicious process; deleting or isolating the file that initiated the suspicious process; restoring from a backup copy the one or more files to which data entry was performed by the suspicious process, wherein the backup copy of the one or more files was created and stored before data entry by the suspicious process to the one or more files occurred; and updating an antivirus database and initiating antivirus software to perform an on-demand scan.

[0017] In one aspect, for each identified file, the machine learning model determines a probability that the modification of the file belongs to one of the categories of file modifications.

[0018] On the one hand, the method also includes: determining, by the analyzer, the number of one or more files for which the probability of modification by the encryptor exceeds a first threshold; and identifying the suspicious process as associated with the encryptor when the determined number of one or more files for which the probability of modification by the encryptor exceeds the first threshold is greater than a second threshold.

[0019] In one aspect, identifying the suspicious process as associated with an encryptor is performed using a trained second machine learning model that receives as input data the identified category of file modification.

[0020] In one aspect, the trained second machine learning model also receives as input data characteristics of the identified suspicious processes.

[0021] On the one hand, the trained second machine learning model includes a machine learning model trained based on at least one of the following: a neural network, a decision tree, a random forest, a support vector machine, a k-nearest neighbor method, a logistic regression method, a linear regression method, a Bayesian classification method, and a gradient boosting method.

[0022] In one aspect, identifying one or more files on which data entry has been performed is based on processing system calls for operations using streams and / or writing streams.

[0023] On the one hand, identifying the one or more files includes identifying characteristics of each identified file, the characteristics including at least one of: entropy of at least a portion of the file, metadata of the file, metadata of the at least a portion of the file, information about an application or process that has input data into the file.

[0024] In one aspect, the trained machine learning model for identifying categories of file modifications includes a first machine learning model based on at least one of: a neural network, a decision tree, a random forest, a support vector machine, a k-nearest neighbor method, a logistic regression method, a linear regression method, a Bayesian classification method, and a gradient boosting method.

[0025] On the one hand, identifying a suspicious process as being associated with an encryptor further comprises: identifying characteristics of the suspicious process, the characteristics comprising at least an identifier and a context of the suspicious process; and identifying events associated with the suspicious process, the events comprising one or more of: a determination by an antivirus program, a change to an autostart list, internet access, and information about the system.

[0026] According to one aspect of the present invention, a system for identifying an encryptor that encodes files of a computer system is provided, the system comprising a hardware processor configured to: identify one or more files whose data input has been executed by a suspicious process; for each identified file, determine the characteristics of the identified file; identify the category of file modification using a trained machine learning model and the corresponding characteristics of the identified file; and identify the suspicious process as being associated with the encryptor based on the category of file modification of the identified file; and protect the computer system from the influence of the encryptor.

[0027] In one exemplary aspect, a non-transitory computer-readable medium is provided on which is stored an instruction set for identifying an encryptor that encodes files of a computer system, wherein the instruction set includes instructions for: identifying one or more files whose data input has been performed by a suspicious process; for each identified file, determining characteristics of the identified file; identifying a category of file modification using a trained machine learning model and corresponding characteristics of the identified file; and identifying the suspicious process as associated with the encryptor based on the category of file modification of the identified file; and protecting the computer system from the encryptor.

[0028] The method and system of the present invention are intended to provide data security in a more optimized and efficient manner and to identify harmful software that encodes files of a computer system. A first technical result is an improved level of protection of computer system files from encryptors by identifying suspicious processes as associated with encryptors using a trained machine learning model. The machine learning model receives as its input data the characteristics of files created or modified by the suspicious process. A second technical result is a reduction in Type I and Type II errors when using the trained machine learning model to identify suspicious processes associated with encryptors. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate one or more exemplary aspects of the present invention and, together with the detailed description, serve to explain the principles and implementations of these exemplary aspects.

[0030] Figure 1 A system for identifying an encryptor is shown.

[0031] Figure 2a A first example of a computer directory after being operated on by an encryptor is shown.

[0032] Figure 2b A second example of a computer directory after being operated on by an encryptor is shown.

[0033] Figure 2c A third example of a computer directory after being operated on by an encryptor is shown.

[0034] Figure 2d A fourth example of a computer directory after being operated on by an encryptor is shown.

[0035] Figure 3 An exemplary protector for a computer system is shown.

[0036] Figure 4An exemplary method for identifying processes associated with unwanted software that encodes files of a computer system is shown.

[0037] Figure 5 An example of a general purpose computer system is presented upon which aspects of the invention may be implemented. DETAILED DESCRIPTION

[0038] Exemplary aspects are described herein in the context of systems, methods, and computer programs for identifying processes associated with harmful software that encodes files of a computer system in accordance with various aspects of the present invention. One of ordinary skill in the art will recognize that the following description is merely illustrative and is not intended to be limiting in any way. Other aspects will readily suggest themselves to one of ordinary skill in the art who appreciates the advantages of the present invention. Reference will now be made in detail to implementations of the exemplary aspects as shown in the accompanying drawings. The same reference numerals will be used throughout the drawings and the following description to refer to the same or similar items as much as possible.

[0039] The system and method of the present invention can identify software that causes damage to a computer system by encoding its files. The system and method also reduces Type I and Type II errors in the identification of suspicious processes associated with encryptors using a trained machine learning model.

[0040] Figure 1 An exemplary system 100 for identifying an encryptor is shown. The system 100 is implemented on a computing system (e.g., a computer) that includes real-world devices, systems, components, and combinations of components that are implemented using hardware such as integrated microcircuits (application-specific integrated circuits, ASICs) or field-programmable gate arrays (FPGAs), or in the form of a combination of software and hardware (e.g., a microprocessor system and a program instruction set), and also on a neurosynaptic chip. The functions of these modules of the system can be implemented solely by hardware, and can also be implemented in a combined form, where some functions of the system modules are implemented by software and some functions are implemented by hardware. In some aspects, some or all of the components, systems, etc. can be implemented on a general-purpose computer (such as a Figure 5 1. The system 100 may be implemented in a single computing device or may be distributed among multiple interconnected computing devices. Thus, the system 100 may be implemented using appropriate hardware components and / or software modules, which may be arranged together or may reside in multiple locations or multiple devices. The components of the system and / or the modules of the system may then interact or exchange data via one or more wireless communication lines, wired communication lines, cellular communications, client / server architectures, peer-to-peer architectures, and the like.

[0041] The system 100 includes a file processor 103, which is designed to identify at least one file 102 (also called a modified file) to which data has been input by a suspicious process 101. The files 102 are identified based on the processing of system calls, in particular system calls for operations on files used by the suspicious process 101 (e.g., WinAPI CreateFile function). In one aspect, system calls for operations using streams, writing streams, etc. are also monitored. The file processor 103 is also designed to identify characteristics of each identified file 102. In one aspect, the characteristics of the file 102 include at least one of the following: entropy (information entropy) of at least a portion of the file 102, metadata of the file 102 (e.g., file extension, type, header, etc.), and the portion of the file 102. In another aspect, the characteristics of the file 102 include information about the application or process that has input data into the file 102. Other examples of characteristics of the file 102 are described below.

[0042] The system 100 also includes an analyzer 104, which is associated with the file processor 103 and is designed to identify one or more modification categories for each file 102, and the file 102 is identified as a modified file. The identification of the modification category is performed using a trained first machine learning model 106, and the trained first machine learning model 106 receives the above-mentioned characteristics of the file 102 as its input data. On the one hand, the modification category of the file 102 includes at least the following categories: modifications made by an encryptor, and modifications made by legitimate software. For each of the above-mentioned files 102, the analyzer 104 is also designed to identify the suspicious process 101 as being associated with an encryptor based on the identified modification category of the file 102.

[0043] The system 100 also includes a trainer 105 designed to train a first machine learning model 106 on data of training samples, the training samples including characteristics of files created or modified by at least one known process and associated with at least one known encryptor.

[0044] In one aspect, the first machine learning model 106 is one of the following types:

[0045] a) Neural Networks;

[0046] b) Decision tree;

[0047] c) Random Forest;

[0048] d) Support vector machine;

[0049] e) k-nearest neighbor method;

[0050] f) Logistic regression;

[0051] g) Linear regression;

[0052] h) Bayesian classification; and

[0053] i) Gradient Boosting.

[0054] It should be noted that, in one aspect, the training samples only include characteristics of files created or modified by at least one known process associated with at least one known encryptor. That is, the characteristics of the original file, before they are modified by the process associated with the encryptor, will not be used to train the first machine learning model 106. This approach has many advantages. In particular, the first machine learning model 106 trained on the above training samples will have a high classification quality and a low number of Type I and Type II errors in the classification of the encryptor because the state of the file before it is modified by the encryptor cannot be identified.

[0055] However, in another aspect, the training samples also include characteristics of files created or modified by at least one known process started by a legitimate file (application).

[0056] The first machine learning model 106 identifies whether the modification of the file belongs to one of the two modification categories. In one aspect, the first machine learning model 106 used for this purpose is a classification (supervised learning) model that operates on the above two categories. In another aspect, the first machine learning model used is a clustering model or an anomaly detection (unsupervised learning) model.

[0057] In one aspect, the first machine learning model 106 comprises a learning model based on a fully connected neural network. In one aspect, the parameters of the neural network, such as the number of internal layers and neurons, activation functions, etc., are selected to provide the best classification quality and the least number of type I and type II errors. In one aspect, the following functions can be used as activation functions: ReLU (rectified linear unit), softmax, logistic function, Heaviside function, etc.

[0058] When an anomaly detection model is used for classification of the first machine learning model 106, a training sample consisting of a single category may be used. That is, the training sample will include characteristics of files created or modified by legitimate software or encryptors. Each group can be checked as an anomaly relative to the other. Thus, an anomaly detection will correspond to one category, while the absence of anomalies will correspond to another category.

[0059] In one aspect, the training samples include files created or modified by known encryptors. In this case, files created or modified by previously unknown encryptors will also be detected by the system 100 to identify the encryptors as training attributes for the machine learning model. As a result, computer system files will receive a higher level of protection, not only against known encryptors, but also against previously unknown encryptors. By using the method of the present invention, Type I and Type II errors in identifying suspicious processes 101 associated with encryptors can be reduced. In another aspect, the training samples include characteristics of files created or modified by legitimate software.

[0060] In yet another aspect, the trainer 105 is further configured to: test the trained first machine learning model 106 on test data, and a validation sample. Testing the trained first machine learning model includes testing the characteristics of files created or modified by at least one known process and associated with at least one known encryptor, wherein the files under test are not in the training sample. Similarly, the validation is for the characteristics of files created or modified by at least one known process and associated with at least one known encryptor, wherein the validation sample is not in the training sample.

[0061] In one aspect, for each identified file 102, the first machine learning model 106 also determines a probability that the modification of the file belongs to one of the modification categories.

[0062] In one aspect, the analyzer 104 determines the number of files (among the identified files 102) for which the probability of modification by the encryptor exceeds a first threshold (e.g., 0.5). Then, when the determined number of files exceeds a second threshold (e.g., 3), the analyzer 104 identifies the suspicious process 101 as being associated with the encryptor. For example, if the number of files for which the probability of modification by the encryptor exceeds 0.5 is greater than 3, the suspicious process 101 will be identified as being associated with the encryptor.

[0063] The above method can reduce the number of false positives compared to signature and heuristic methods that check a file for modification according to specified rules. When using signature and heuristic methods, if a file is modified by legitimate software (such as an archiver) and contains modification characteristics of an encryptor, the suspicious process 101 may be identified as an encryptor even if it is actually a legitimate process.

[0064] In one aspect, as described above, the present invention uses unique parameters and features to identify an encryptor that can be used by the analyzer 104. Some examples of various unique parameters and features that are characteristic of files created or modified by an encryptor are given below.

[0065] In one aspect, the file parameters and features mentioned below may also be used as file characteristics to be used by the analyzer 104 .

[0066] One file characteristic is entropy (information entropy). Information entropy can be calculated by any formula known in the relevant art, in particular as follows:

[0067]

[0068] Among them, H is the information entropy, and p(i) is the probability of the occurrence of the symbol with value i.

[0069] Encryptors operate using encryption algorithms such as AES, RSA, RC4, etc. There are various criteria for evaluating the quality of encryption algorithms, such as the comparison of entropy values. Entropy values ​​can be used to identify encrypted or random data, and specific entropy values ​​are characteristic of various file formats. However, identifying files modified by encryptors based solely on file entropy values ​​will result in a Type I error. This is because archive formats such as "rar", "zip", "7z", etc. have similar entropy to files created by harmful encryptors (if they have similar compression levels), but are distinguished by the presence of a specific file structure through which the files can be decompressed. Special attention must be paid to formats such as "docx" because they also contain data archives, are widely used and require encryption. It must also be remembered that there are a large number of well-known file formats, and companies may create special formats for internal use. Therefore, comparing files created by a program to a set of known formats is ineffective as a means of identifying harmful activities and encryptors.

[0070] Additional difficulties arise from encryptors that do not modify the entire file but only encrypt a portion of the file. For this case, the entropy of individual portions of the file can be calculated. For example, the file can be divided into multiple portions of equal size, and the entropy of each portion of the file (hereinafter referred to as segment entropy) can then be calculated. In many data archives, portions of a file are separated to preserve the original file name, but this rarely happens with encryptors. Therefore, the minimum segment entropy can be used as another file characteristic.

[0071] Entropy is affected by file size; therefore, file size can also be used as a file characteristic.

[0072] In many cases, the characteristic feature of a file created by an encryptor is the specific name of the encrypted file. Therefore, the file name can also be used as one of the file characteristics.

[0073] Figure 2a A first example of a computer directory after being operated by an encryptor is shown. In some cases, the malicious party's email address often appears in the file name. For example, in Figure 2aAn example of a directory after the operation of the Trojan-Ransom.Win32.Crysis encryptor is shown in . Therefore, the information on whether there is a string of names corresponding to the RFC 5322 mailbox format can be used as another file characteristic.

[0074] Figure 2b A second example of a computer directory after being operated on by an encryptor is shown. Figure 2b In , an example of a directory after another type of encryptor operation is shown, in which the encryptor modifies the file name, and the modified file name consists of a string of hexadecimal characters. Therefore, compliance or non-compliance with the format can be used as input to the analysis part of the system. On the other hand, parameters such as symbol ranges can be used, names with file extensions or period symbols, etc. can be used. These other features are usually not characteristic features of legitimate files, but are encountered in files encrypted by the encryptor, so files with these atypical features can be identified and placed in a separate group. It is also possible to check whether there are special symbols that are rarely encountered in legitimate file names but are present in encrypted file names, such as "[", "]", "{", "}", "@", arithmetic operator symbols, etc. Figure 2c A third example of a computer directory encountering special symbols after an encryptor operation is shown.All of the above parameters and features can be used by the analyzer 104 as file characteristics.

[0075] In executable files, data archives and "docx" and "pdf" formats there are byte sequences that can be interpreted as strings of a given length. However, in encrypted files the strings are extremely short and they take the form of random sequences of symbols, which are rarely encountered in legitimate files. The number of strings, the longest length of a string and the average string length can be selected as file characteristics.

[0076] In most cases, the encryptor exchanges the file extension for a non-existent file extension, so the fact that the file extension corresponds to a non-existent format can also be used as a file property. Figure 2d A fourth example of a computer directory after being operated by an encryptor (e.g., a fast encryptor) is shown. In this case, the file extension is very long, which is not a typical characteristic of legitimate files.

[0077] Another unique attribute of the encrypted files is the presence of specific words, such as "lol", "fox", "ransom", etc. When using a signature-based detection method, it is necessary to create a "white list" of allowed file extensions or a "black list" of prohibited extensions. That is, software that has created a large number of files with such extensions will be considered harmful. However, creating such white lists and black lists is an extremely laborious task, and the lists must always contain up-to-date information about all extensions used in both legitimate and harmful software, which is impossible. In addition, there are cases where harmful software may imitate legitimate software, in which cases the encryptor will not be detected. Therefore, the above method itself is not complete. However, this type of list can be added to the first machine learning model 106 as a file feature. In this case, the file extension will be compared to a scale, for example, zero represents a trusted extension, and a larger value is assigned to a group with more suspicious extensions. By considering other file characteristics and parameters of the first machine learning model 106, the level of encryptor detection can be improved.

[0078] In one aspect, if the number of files classified as modified by the encryptor exceeds a second threshold, the analyzer 104 identifies the suspicious process 101 as being associated with the encryptor (that is, the category of modification corresponds to modifications made by the encryptor). In a preferred aspect, when the analyzer 104 identifies the modification category for each identified file 102, it is not necessary to determine the probability of belonging to a certain modification category.

[0079] In one aspect, the analyzer 104 is further configured to identify a suspicious process as being associated with an encryptor by using a trained second machine learning model 107. The second machine learning model 107 receives as its input data the identified modification category of each identified file 102; that is, the second machine learning model receives the results of using the first machine learning model 106.

[0080] In yet another aspect, the file processor 103 further identifies:

[0081] a) characteristics of the suspicious process 101, in particular, an identifier of the suspicious process and a context of the suspicious process;

[0082] b) events in the protector 108 (for example, an antivirus system) associated with the checked process, in particular determinations of the antivirus program and various modules of the antivirus system, changes to the automatic startup list, Internet access, etc.; and

[0083] c) Information about the system.

[0084] In one aspect, the second machine learning model 107 also receives the identified characteristics of the suspicious process, the above-mentioned antivirus events and system information as input data. The above-mentioned antivirus events and system information can be determined by the file processor 103 itself, or with the help of the protector 108.

[0085] In one aspect, the second machine learning model 107 comprises a machine learning model trained based on at least one of:

[0086] a) Neural Networks;

[0087] b) Decision tree;

[0088] c) Random Forest;

[0089] d) Support vector machine;

[0090] e) k-nearest neighbor method;

[0091] f) Logistic regression;

[0092] g) Linear regression;

[0093] h) Bayesian classification; and

[0094] i) Gradient Boosting.

[0095] In yet another aspect, the trainer 105 is designed to train a second machine learning model 107 on data from a second training sample, the second training sample comprising modification categories of files created or modified by at least one known process associated with at least one known encryptor.

[0096] In one aspect, the second training sample includes modification categories of files created or modified by at least one known legitimate process associated with at least one known legitimate piece of software.

[0097] In another aspect, the trainer 105 is also designed to test and validate the trained second machine learning model 107. In one aspect, the testing is performed on data for the second test, the data for the second test including characteristics of files created or modified by at least one known process and associated with at least one known encryptor, wherein the files in the second test are not in the second training sample. Similarly, the validation is performed on a validation sample, the validation sample including characteristics of files created or modified by at least one known process and associated with at least one known encryptor, wherein the second validation sample is not in the second training sample. It should also be noted that other specific implementations described above with respect to the first machine learning model 106 may also be used for the second machine learning model 107.

[0098] Figure 3An exemplary protector of a computer system is shown, such as protector 108 of computer 20. Protector 108 (antivirus program or other form of protection for a device) can include modules designed to ensure the security of the device. In one example, protector 108 includes at least one of the following: an on-access scanner, an on-demand scanner, email antivirus software, network antivirus software, an active protection module, a HIPS (host intrusion prevention system) module, a DLP (data loss prevention) module, a vulnerability scanner, a simulator, a firewall, etc. In one aspect, the above modules can be an integral part of protector 108. In another aspect, these modules can be implemented in the form of separate software components.

[0099] The on-access scanner contains functionality for identifying harmful activity in all openable, executable, and storable files on the user's computer system.

[0100] An on-demand scanner differs from an on-access scanner in that it scans user-specified files and directories, i.e., at the request of a user.

[0101] Email antivirus software is necessary to control incoming and outgoing email. Email antivirus software checks incoming and outgoing email to determine if the email contains harmful software.

[0102] Web antivirus software is used to prevent the execution of harmful code that may be present on websites visited by users and is used to block such websites from opening.

[0103] The HIPS module is used to identify any unexpected and harmful activities of a program at the time of execution and block the program.

[0104] The DLP module is used to identify and prevent confidential data from leaking beyond the boundaries of a computer or network.

[0105] A vulnerability scanner may be necessary to identify vulnerabilities in the device (eg, if certain components of the protector 108 are turned off, if the virus database is not up to date, if a network port is closed, etc.).

[0106] Firewalls are used to control and filter network traffic according to specified rules.

[0107] The simulator operates by emulating the client system in the simulator during the execution of file instructions and obtains results which are then examined in detail.

[0108] The active protection module uses behavioral signatures to identify the behavior of executable files and their classification by confidence level. It should be noted that the protector 108 may also include a Figure 1 Other modules with functionality described in .

[0109] Figure 4 An exemplary method 400 for identifying an encryptor is shown. For example, method 400 identifies a process associated with harmful software (e.g., an encryptor) that encodes files of a computer system. When an unknown file is executed, a new process with a new process identifier (PID) is created (e.g., by a WinAPI CreateProcess function). The method of the present invention examines the new process as a suspicious process. It should also be noted that the method of the present invention also allows the process to be identified as being associated with an encryptor when the process is trusted (e.g., a system process) but creates or modifies files in the same manner as the encryptor. This situation may occur when fileless harmful software (fileless malware) is used. For example, this harmful software may use trusted PowerShell software to execute harmful commands. Harmful code is not stored on disk as a file, but is only contained in random access memory, and therefore cannot be detected by scanning files in a computer system.

[0110] Thus, in one aspect, the method of the present invention detects fileless malware by examining all processes of a computer system as suspicious processes. In another aspect, the method scans only those processes that are on a specified updateable list, rather than scanning all processes as suspicious processes. The updateable list may include suspicious system processes and those processes most commonly used by encryptors. In one aspect, the method 400 for identifying encryptors is performed on a computing device (e.g., Figure 5 This updatable list can be updated manually or automatically if new suspicious processes or new processes most commonly used by encryptors are detected.

[0111] In step 401, method 400 identifies one or more files 102 to which suspicious process 101 performs data input via file processor 103. Data input includes at least one of creating a new file and modifying an existing file. In one aspect, at least one file 102 is identified based on processing of a system call for a file operation used by suspicious process 101.

[0112] In step 402 , the method 400 determines, by the file processor 103 , characteristics of the identified file 102 for each identified file 102 of the one or more files.

[0113] In step 403, the method 400 identifies the category of file modification for each identified file by the analyzer 104. The identification of the file modification category is performed using the trained first machine learning model 106 and the corresponding characteristics of the identified file. Therefore, in one aspect, the first machine learning model 106 receives the above characteristics of the identified file 102 as its input data.

[0114] In one aspect, the categories of file modifications include at least one category of file modifications made by an encryptor and at least one other category of file modifications made by legitimate software.

[0115] In step 404 , the method 400 , by the analyzer 104 , identifies, for each identified file, the suspicious process 101 as being associated with an encryptor based on the category of the identified file modification for each file 102 .

[0116] In step 405, method 400 protects the computer system from the encryptor via protector 108. Thus, after identifying suspicious process 101 as being associated with the encryptor, protector 108 protects the computer system from the actions of the encryptor.

[0117] In one aspect, protection of a computer system includes at least one of:

[0118] a) Stop the suspicious process and all flows and other processes associated with the suspicious process;

[0119] b) Delete or isolate the files that start suspicious processes;

[0120] c) restoring one or more files to which data entry was performed by the suspicious process from a backup copy, wherein the backup copy of the one or more files was created and stored before the data entry by the suspicious process to the one or more files occurred; and

[0121] d) Update the antivirus database and launch the antivirus software to perform an on-demand scan.

[0122] In one aspect, for each identified file, the machine learning model determines a probability that the modification of the file belongs to one of the file modification categories.

[0123] On the one hand, the method also includes: determining, by the analyzer, the number of one or more files for which the probability of modification by the encryptor exceeds a first threshold; and identifying the suspicious process as associated with the encryptor when the number of one or more files for which the determined probability of modification exceeds the first threshold is greater than a second threshold.

[0124] In accordance with Figure 1 The specific examples of implementations described in the system are also applicable to the system according to Figure 4Method. Thus, the claimed systems and methods are capable of identifying processes associated with harmful software (e.g., software that encrypts files of a computer system). The level of protection of computer system files from encryptors is improved by identifying suspicious processes as associated with an encryptor, and using a trained machine learning model that receives as its input the characteristics of files created or modified by the suspicious process. In addition, a reduction in Type I and Type II errors is achieved for identifying suspicious processes associated with an encryptor. The reduction in errors is achieved by using a trained machine learning model that receives as its input data the characteristics of files created or modified by the suspicious process.

[0125] Figure 5 is a block diagram illustrating a computer system 20 on which aspects of the system and method for identifying an encryptor that encodes a file of a computer system may be implemented. The computer system 20 may be in the form of multiple computing devices or in the form of a single computing device, such as a desktop computer, a laptop computer, a handheld computer, a mobile computing device, a smartphone, a tablet computer, a server, a mainframe, an embedded device, and other forms of computing devices.

[0126] As shown, computer system 20 includes a central processing unit (CPU) 21, a system memory 22, and a system bus 23 connecting various system components, including a memory associated with the central processing unit 21. The system bus 23 may include a bus memory or a bus memory controller, a peripheral bus, and a local bus capable of interacting with any other bus architecture. Examples of buses may include PCI, ISA, PCI-Express, HyperTransport, and the like. TM (HyperTransport TM ), unlimited bandwidth TM (InfiniBand TM ), Serial ATA, I 2C, and other suitable interconnections. The central processing unit 21 (also referred to as a processor) may include a single or multiple groups of processors having a single core or multiple cores. The processor 21 may execute one or more computer executable codes that implement the technology of the present invention. The system memory 22 may be any memory for storing data used herein and / or computer programs executable by the processor 21. The system memory 22 may include volatile memory (such as random access memory (Random Access Memory, RAM) 25) and non-volatile memory (such as read-only memory (Read-Only Memory, ROM) 24, flash memory, etc.) or any combination thereof. The basic input / output system (Basic Input / Output System, BIOS) 26 may store basic programs for transmitting information between elements of the computer system 20, such as those basic programs when the operating system is loaded using ROM 24.

[0127] The computer system 20 may include one or more storage devices, such as one or more removable storage devices 27, one or more non-removable storage devices 28, or a combination thereof. The one or more removable storage devices 27 and the one or more non-removable storage devices 28 are connected to the system bus 23 by means of a memory interface 32. In one aspect, the storage devices and corresponding computer-readable storage media are power-independent modules for storing computer instructions, data structures, program modules, and other data of the computer system 20. The system memory 22, the removable storage devices 27, and the non-removable storage devices 28 may use a variety of computer-readable storage media. Examples of computer-readable storage media include: machine memory, such as cache, SRAM, DRAM, zero-capacitor RAM, two-transistor RAM, eDRAM, EDO RAM, DDR RAM, EEPROM, NRAM, RRAM, SONOS, PRAM; flash memory or other storage technology, such as in a Solid State Drive (SSD) or a flash drive; magnetic cassettes, tapes, and disk storage, such as in a hard drive or floppy disk; optical storage, such as in a compact disk (CD-ROM) or a digital versatile disk (DVD); and any other medium that can be used to store the desired data and can be accessed by the computer system 20.

[0128] The system memory 22, removable storage device 27 and non-removable storage device 28 of computer system 20 can be used to store operating system 35, additional application programs 37, other program modules 38 and program data 39. Computer system 20 may include a peripheral interface 46 for transmitting data from input device 40, such as a keyboard, mouse, stylus, game controller, voice input device, touch input device, or other peripheral devices, such as a printer or scanner by means of one or more I / O ports, such as a serial port, parallel port, Universal Serial Bus (USB), or other peripheral interfaces. Display device 47 (such as one or more monitors, projectors or integrated displays) can also be connected to system bus 23 through output interface 48 (such as a video adapter). In addition to display device 47, computer system 20 can also be equipped with other peripheral output devices (not shown), such as speakers and other audio-visual devices.

[0129] The computer system 20 can work in a network environment using a network connection with one or more remote computers 49. The one or more remote computers 49 can be local computer workstations or servers, which include most or all of the elements described above in describing the properties of the computer system 20. Other devices can also be present in the computer network, such as but not limited to routers, network workstations, peer devices or other network nodes. The computer system 20 may include one or more network interfaces 51 or network adapters for communicating with the remote computer 49 by means of one or more networks, such as a computer local area network (LAN) 50, a computer wide area network (WAN), an intranet, and the Internet. Examples of the network interface 51 may include an Ethernet interface, a frame relay interface, a SONET (synchronous optical network) interface, and a wireless interface.

[0130] Various aspects of the present invention may be systems, methods and / or computer program products. The computer program products may include one or more computer-readable storage media having computer-readable program instructions for causing a processor to perform various aspects of the present invention.

[0131] Computer readable storage medium can be a tangible device, and this tangible device can keep and store the program code of the form of instruction or data structure, and this program code can be accessed by the processor of computing device (such as computer system 20).Computer readable storage medium can be electronic storage device, magnetic storage device, optical storage device, electromagnetic storage device, semiconductor storage device or its any suitable combination.As an example, this type of computer readable storage medium can include random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), portable optical disc read-only memory (CD-ROM), digital versatile disc (DVD), flash memory, hard disk, portable computer disk, memory stick, floppy disk or even mechanical coding device, such as punch card or convex structure in the groove of recording instruction thereon.As used in this article, computer readable storage medium should not be regarded as temporary signal itself, temporary signal such as radio wave or other free propagation electromagnetic wave, electromagnetic wave propagated by waveguide or transmission medium or electric signal transmitted by wire.

[0132] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to a corresponding computing device, or downloaded to an external computer or external storage device via a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network). The network can include copper transmission cables, optical transmission fibers, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network interface in each computing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium in the corresponding computing device.

[0133] The computer-readable program instructions for performing the operation of the present invention can be assembly instructions, instruction set architecture (Instruction-Set-Architecture, ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data or source code or object code written in any combination of one or more programming languages ​​(including object-oriented programming languages ​​and traditional programmed programming languages).Computer-readable program instructions (as independent software packages) can be performed completely on the user's computer, partly on the user's computer, partly on the user's computer and partly on a remote computer or completely on a remote computer or server.In the latter case, the remote computer can be connected to the user's computer through any type of network (including LAN or WAN), or can be connected to an external computer (for example, through the Internet).In some respects, electronic circuits (including for example programmable logic circuits, field programmable gate arrays (FPGAs) or programmable logic arrays (Programmable Logic Arrays, PLAs)) can be performed by utilizing the state information of computer-readable program instructions to personalize the electronic circuit, thereby performing aspects of the present invention.

[0134] In various aspects, the systems and methods described in the present invention can be processed in modules. The term "module" as used herein refers to, for example, a real-world device, component, or arrangement of components implemented using hardware (e.g., by an application-specific integrated circuit (ASIC) or FPGA), or to a combination of hardware and software, such as a microprocessor system and an instruction set that implements the module's functions (the instruction set converts the microprocessor system into a special-purpose device when executed). Modules can also be implemented as a combination of the above two, where certain functions are implemented only by hardware and other functions are implemented by a combination of hardware and software. In some implementations, at least a portion of a module (and in some cases, all of a module) can be implemented in a computer system (such as the above Figure 5 Therefore, each module can be implemented in various suitable configurations and should not be limited to any specific implementation illustrated in this article.

[0135] For the sake of clarity, not all routine features of various aspects are disclosed herein. It should be appreciated that in the development of any practical implementation of the present invention, many specific implementation decisions must be made in order to achieve the developer's specific goals, and these specific goals will vary for different implementations and different developers. It should be understood that such development efforts can be complex and time-consuming, but are still a routine task of engineering for those of ordinary skill in the art who understand the advantages of the present invention.

[0136] In addition, it should be understood that the words or terms used herein are for the purpose of description rather than limitation, so the terms or terms of this specification should be interpreted by those skilled in the art according to the teachings and guidance provided herein in combination with the knowledge of (one or more) relevant technical personnel. In addition, it is not intended to attribute any term in this specification or claims to an uncommon or special meaning unless explicitly stated as such.

[0137] The various aspects disclosed herein include the present and future known equivalents of the known modules cited herein in an illustrative manner. In addition, although various aspects and applications have been shown and described, it will be apparent to those skilled in the art who understand the advantages of the present invention that more modifications than those mentioned above are feasible without departing from the inventive concept disclosed herein.

Claims

1. A method for identifying an encryptor that encodes a file of a computer system, the method comprising: identifying, by the file processor, one or more files that have had data input performed by a suspicious process, wherein identifying the one or more files includes identifying characteristics of each identified file, the characteristics including at least one of: entropy of at least a portion of the file, and information about an application or process that has input data into the file; For each identified file, determining, by the file processor, a characteristic of the identified file; For each identified file, identifying, by the analyzer, a category of file modification using the trained machine learning model and corresponding characteristics of the identified file; and For each identified file, the analyzer identifies a suspicious process as being associated with the encryptor based on the identified category of file modification of the file, wherein identifying the suspicious process as being associated with the encryptor comprises: determining a number of the one or more files for which a probability of modification of the file exceeds a first threshold; identifying the suspicious process as being associated with the encryptor when the determined number of the one or more files for which the probability of modification of the file exceeds the first threshold is greater than a second threshold; and The computer system is protected from the encryptor.

2. The method of claim 1, further comprising: Harmful software is detected by sequentially checking all processes of the computer system, wherein the sequential checking includes identifying the checked process as the suspicious process.

3. The method of claim 1, wherein: The suspicious process is associated with an updateable list of predetermined processes.

4. The method of claim 1, wherein: The categories of file modifications include at least one category of file modifications made by an encryptor and at least one other category of file modifications made by legitimate software.

5. The method of claim 1, wherein: The protection of the computer system includes at least one of the following: Stopping the suspicious process and all flows and other processes associated with the suspicious process; Delete or quarantine the file that started the suspicious process; restoring the one or more files to which data entry was performed by the suspicious process from a backup copy, wherein the backup copy of the one or more files was created and stored before data entry into the one or more files by the suspicious process occurred; as well as Update the antivirus database and launch the antivirus software to perform an on-demand scan.

6. The method of claim 1, wherein: For each identified file, the machine learning model determines a probability that a modification of the file belongs to one of the categories of file modifications.

7. The method of claim 1, wherein: Identifying the suspicious process as being associated with the encryptor is performed using a trained second machine learning model that receives as input data the identified category of file modification of the file.

8. The method of claim 7, wherein: The trained second machine learning model also receives the identified characteristics of the suspicious process as input data.

9. The method of claim 7, wherein: The trained second machine learning model includes a machine learning model trained based on at least one of the following: a neural network, a decision tree, a random forest, a support vector machine, a k-nearest neighbor method, a logistic regression method, a linear regression method, a Bayesian classification method, and a gradient boosting method.

10. The method of claim 1, wherein: Identifying the one or more files for which data entry was performed is based on processing of system calls for operations using streams and / or writing streams.

11. The method of claim 1, wherein: Identifying the one or more files includes identifying characteristics of each identified file, the characteristics further including at least one of: metadata of the file, metadata of the at least a portion of the file.

12. The method of claim 1, wherein: The trained machine learning model for identifying the category of the file modification includes a first machine learning model based on at least one of the following: a neural network, a decision tree, a random forest, a support vector machine, a k-nearest neighbor method, a logistic regression method, a linear regression method, a Bayesian classification method, and a gradient boosting method.

13. The method of claim 1, wherein: Identifying the suspicious process as being associated with the encryptor further comprises: identifying characteristics of the suspicious process, the characteristics including at least an identifier and a context of the suspicious process; and Events associated with the suspicious process are identified, the events comprising one or more of: a determination by an antivirus program, a change to an autostart list, Internet access, and information about the system.

14. A system for identifying an encryptor that encodes a file of a computer system, comprising: at least one processor, the at least one processor being configured to: identifying, by the file processor, one or more files that have had data input performed by a suspicious process, wherein identifying the one or more files includes identifying characteristics of each identified file, the characteristics including at least one of: entropy of at least a portion of the file, and information about an application or process that has input data into the file; For each identified file, determining, by the file processor, a characteristic of the identified file; For each identified file, identifying, by the analyzer, a category of file modification using the trained machine learning model and corresponding characteristics of the identified file; and For each identified file, the analyzer identifies a suspicious process as being associated with the encryptor based on the identified category of file modification of the file, wherein identifying the suspicious process as being associated with the encryptor comprises: determining a number of the one or more files for which a probability of modification of the file exceeds a first threshold; identifying the suspicious process as being associated with the encryptor when the determined number of the one or more files for which the probability of modification of the file exceeds the first threshold is greater than a second threshold; and The computer system is protected from the encryptor.

15. The system of claim 14, wherein: The processor is further configured to: Harmful software is detected by sequentially checking all processes of the computer system, wherein the sequential checking includes identifying the checked process as the suspicious process.

16. The system of claim 14, wherein: The suspicious process is associated with an updateable list of predetermined processes.

17. The system of claim 14, wherein: The protection of the computer system includes at least one of the following: Stopping the suspicious process and all flows and other processes associated with the suspicious process; Delete or quarantine the file that started the suspicious process; Restoring the one or more files to which the suspicious process has input data from a backup copy, wherein the backup copy of the one or more files was created and stored before the input of data into the one or more files by the suspicious process occurred; as well as Update the antivirus database and launch the antivirus software to perform an on-demand scan.

18. A non-transitory computer-readable medium having stored thereon computer-executable instructions for identifying an encryptor that encodes a file of a computer system, the computer-executable instructions comprising instructions for: One or more files having data input executed by a suspicious process are identified by a file processor, wherein: Identifying the one or more files includes identifying characteristics of each identified file, the characteristics including at least one of: entropy of at least a portion of the file, and information about an application or process that has input data into the file; For each identified file, determining, by the file processor, a characteristic of the identified file; For each identified file, the analyzer uses the trained machine learning model and the corresponding characteristics of the identified file to identify a category of file modification; as well as For each identified file, the analyzer identifies a suspicious process as being associated with the encryptor based on the identified category of file modification of the file, wherein identifying the suspicious process as being associated with the encryptor comprises: determining a number of the one or more files for which a probability of modification of the file exceeds a first threshold; identifying the suspicious process as being associated with the encryptor when the determined number of the one or more files for which the probability of modification of the file exceeds the first threshold is greater than a second threshold; and The computer system is protected from the encryptor.

19. The non-transitory computer readable medium of claim 18, wherein: The computer executable instructions also include instructions for: Harmful software is detected by sequentially checking all processes of the computer system, wherein the sequential checking includes identifying the checked process as the suspicious process.

20. The non-transitory computer readable medium of claim 18, wherein: The suspicious process is associated with an updateable list of predetermined processes.

Images